docs: four-section /docs/ restructure with new-user content, accuracy pass, and gateway feature-set rewrite

Restructures /docs/ by reader purpose (tutorials, how-to,
reference, design), adds the new-user-progression and
operator-recipe content the prior layout lacked, runs an
accuracy pass against current source across the pre-existing
design docs, and rewrites the gateway feature-set documentation
end-to-end around its actual operational profile (a niche
feature designed for systems already serving DHCP/DNS to a
LAN, with two independent halves — outbound LAN→mesh, inbound
mesh→LAN — sharing one nftables table, one binary, and one
control socket). Top-level README and getting-started rewritten
around two equally-weighted deployment modes (overlay on
existing IP networks; ground-up over non-IP transports).

## Additions

- 11 new tutorials in docs/tutorials/: an 8-step new-user
  progression from single-daemon test-mesh peering through
  to a ground-up two-device mesh, an IPv6-adapter side-trip
  walkthrough, an Advanced Tutorials index, and a hand-held
  OpenWrt walk-through for fips-gateway deployment that
  exercises both halves of the feature.
- 12 new how-tos in docs/how-to/: firewall activation,
  Nostr discovery (resolve / advertise / open across five
  scenarios), Tor onion (directory + control_port modes),
  UDP buffer tuning, unprivileged-user setup, persistent
  identity, host aliases, Bluetooth LE peering, MTU
  diagnostics, manual Linux-host gateway deployment (covers
  both halves), gateway troubleshooting (organised by half),
  and a section index.
- 9 new reference docs in docs/reference/: configuration,
  wire formats, control-socket protocol, four CLI references
  (fips, fipsctl, fipstop, fips-gateway), security posture
  matrix, and Nostr events catalog. Configuration and
  wire-formats are renamed-and-extended from prior design/
  versions; the other seven are net-new.
- 6 new design docs: fips-concepts, fips-architecture, and
  fips-prior-work split out of the deleted fips-intro.md;
  consolidated fips-mmp and fips-mtu aggregations; and a
  new generic port-advertisement-and-nat-traversal doc
  (Nostr-signaled port advertisement plus UDP NAT-traversal
  protocol, FIPS as an example implementation, suitable for
  eventual NIP submission).
- Top-level docs/getting-started.md walking through the
  binary-installer-only Install story.
- packaging/common/hosts pre-populated with the eight public
  test-mesh nodes so shortnames resolve out of the box on
  every fresh install.

## Changes

- 23 wire-format diagrams relocated to reference/diagrams/
  alongside the wire-formats move.
- 4 design diagrams corrected against source code
  (fips-protocol-stack, fips-identity-derivation,
  fips-coordinate-discovery, fips-routing-decision).
- 10 pre-existing design docs reconciled with current
  source. Numeric corrections: stale link-MMP report bounds
  (now [1s, 5s] with 200 ms cold-start floor); UDP default
  MTU (now 1280, IPv6 minimum); node_addr formula
  (SHA-256(pubkey)[..16]); Noise patterns (IK at link, XK
  at session); peer-ACL semantics (strict allowlist requires
  ALL in peers.deny); daemon DNS upstream ([::1]:5354);
  on-the-wire bloom-filter size (1,071 bytes); obsolete
  Cargo-feature references (PR #79 dropped them) removed.
- Transport framing tightened across the docs: TCP is for
  UDP-filtered networks (not NAT traversal); Tor is a
  deployment mode (not failover); WebSocket dropped (not a
  shipped FIPS transport); WiFi promoted to Implemented via
  Ethernet in infrastructure mode; classic-Bluetooth row
  removed (BLE is the only Bluetooth-mode transport).
- docs/design/fips-gateway.md rewritten end-to-end to lead
  with the niche-feature framing and the two-halves
  structure. Title moved from "FIPS Outbound LAN Gateway"
  to "FIPS Gateway"; architecture section describes the
  common machinery (the fips-gateway service, the nftables
  table, the control socket) before splitting into separate
  "Outbound Half" and "Inbound Half" sections of equal
  weight; security considerations split per-half; no Future
  Work section (speculative directions live in the project
  tracker, not in protocol design docs). Inbound port
  forwarding is a first-class half rather than a buried
  "Implemented Extensions" subsection.
- Gateway terminology unified across all gateway docs as a
  separate Linux service running alongside the fips daemon
  (its own systemd unit / OpenWrt init script). Container-
  pattern terms (sidecar) are reserved for the
  Docker/Kubernetes sidecar deployment examples — the
  testing/sidecar/ tree, examples/k8s-sidecar/,
  examples/sidecar-nostr-relay/,
  examples/wireguard-sidecar-macos/, and the related
  CHANGELOG / top-level README entries — where the term
  carries its standard container meaning.
- Net-new design body content: rekey section in
  fips-mesh-layer (Noise IK msg1/msg2 over the established
  link, K-bit cutover, drain window, smaller-NodeAddr-wins
  tie-breaker on dual-init); Mesh Size Estimation and
  Antipoison FPR Cap sections in fips-bloom-filters;
  Mesh-Interface Query Filter subsection in
  fips-ipv6-adapter; failure-suppression knobs and clock-
  skew tolerance in fips-nostr-discovery; loop-rejection
  and mid-chain ancestor swap added to spanning-tree
  propagation / stability rules; Priority Chain in
  fips-mesh-operation renumbered to match the
  routing-decision diagram.
- Top-level README: dropped the stale nostr-discovery
  cargo-feature parenthetical. docs/README.md and the four
  section READMEs (tutorials, how-to, reference, design)
  refreshed for the new structure; index rows reflect both
  halves of the gateway feature and the new fips-gateway
  CLI reference.
- Cargo.toml [package.metadata.deb] assets path updated for
  the fips-security.md move; .gitignore /reference/ rule
  anchored to repo root so docs/reference/ is trackable.
- packaging/openwrt-ipk/files/etc/fips/fips.yaml
  configuration-doc URL updated to the new
  docs/reference/configuration.md location.

## Deletions

- docs/design/fips-intro.md (split into the three new intro
  design docs).
- docs/design/document-relationships.svg (orphan, no longer
  referenced).
- docs/proposals/ tree removed; the only proposal it
  contained (the Nostr UDP hole-punch protocol) was
  rewritten as the new generic
  design/port-advertisement-and-nat-traversal.md.

docs/how-to/enable-mesh-firewall.md

@@ -0,0 +1,158 @@
+# Enable the Mesh-Interface Firewall
+
+FIPS ships a default-deny nftables baseline at `/etc/fips/fips.nft` that
+restricts inbound traffic on the `fips0` mesh interface to conntrack
+replies and ICMPv6 echo. The baseline is **not** enabled by default — see
+[../design/fips-security.md](../design/fips-security.md) for the threat
+model and the rationale behind keeping activation explicit. This guide
+covers the operator steps to load the baseline, extend it with per-host
+allowances, and inspect drops.
+
+## Activate the baseline
+
+The package ships `fips-firewall.service`, a systemd oneshot that runs
+`nft -f /etc/fips/fips.nft` on start and removes the `inet fips` table
+on stop. To activate:
+
+```sh
+sudo systemctl enable --now fips-firewall.service
+```
+
+This loads the table now and arranges for it to load on every subsequent
+boot. To disable and tear it down:
+
+```sh
+sudo systemctl disable --now fips-firewall.service
+```
+
+To reload after editing `/etc/fips/fips.nft` or adding a drop-in under
+`/etc/fips/fips.d/`:
+
+```sh
+sudo systemctl reload-or-restart fips-firewall.service
+```
+
+The file is idempotent — it begins with `add table inet fips; flush
+table inet fips;` so re-running it replaces the live ruleset atomically.
+Equivalently:
+
+```sh
+sudo nft -f /etc/fips/fips.nft
+```
+
+## Folding the baseline into the host's main nftables
+
+If you prefer to load the baseline from your existing
+`/etc/nftables.conf` rather than via the systemd unit, include it
+directly:
+
+```nft
+# in /etc/nftables.conf
+include "/etc/fips/fips.nft"
+```
+
+In that case do **not** enable `fips-firewall.service` — the host's main
+nftables setup owns the loading. The two paths are mutually exclusive.
+
+## Extend with per-host allowances via drop-ins
+
+The baseline drops everything inbound on `fips0` except conntrack
+replies and ICMPv6 echo. To open specific services to specific mesh
+nodes, drop a file into `/etc/fips/fips.d/` ending in `.nft`. Each
+file is included inline into the `inbound` chain at the marked point
+and may contain any nftables rule lines valid in that context.
+
+Reload after editing:
+
+```sh
+sudo systemctl reload-or-restart fips-firewall.service
+# or:  sudo nft -f /etc/fips/fips.nft
+```
+
+### Allow inbound SSH from a specific mesh node
+
+```nft
+# /etc/fips/fips.d/ssh-from-bastion.nft
+ip6 saddr fd97:1234:5678:9abc:def0:1234:5678:9abc tcp dport 22 accept
+```
+
+The source filter is the node's mesh address. To find a node's mesh
+address, look in their `fips.pub` (which contains the npub) and derive
+the `fd97:...` address from it, or query the running daemon:
+
+```sh
+fipsctl show identity-cache
+fipsctl show peers
+```
+
+### Allow inbound DNS broadly
+
+Some services need to be reachable from any mesh node (a public DNS
+resolver, a public bootstrap node):
+
+```nft
+# /etc/fips/fips.d/dns-public.nft
+udp dport 53 accept
+tcp dport 53 accept
+```
+
+Omit the source filter only when the service is intended to be
+universally reachable on the mesh. The baseline's purpose is to make
+"universally reachable" an explicit decision rather than the default.
+
+### Multiple nodes, one service
+
+```nft
+# /etc/fips/fips.d/git-from-trusted.nft
+ip6 saddr {
+    fd97:1111:2222:3333:4444:5555:6666:7777,
+    fd97:8888:9999:aaaa:bbbb:cccc:dddd:eeee
+} tcp dport 9418 accept
+```
+
+Set syntax keeps multi-node rules readable and is more efficient than a
+chain of individual rules.
+
+## Inspect drops
+
+The baseline counter increments on every dropped packet. Inspect it:
+
+```sh
+sudo nft list table inet fips
+```
+
+Look for the `counter packets N bytes M drop` line at the bottom of the
+`inbound` chain. A non-zero counter means mesh nodes are sending
+traffic that hits the default-deny — usually benign (probes, neighbor
+discovery) but occasionally a misconfigured drop-in.
+
+To see which packets are being dropped, uncomment the `log` line near
+the bottom of `/etc/fips/fips.nft`:
+
+```nft
+log prefix "fips drop: " level info limit rate 10/minute
+```
+
+Reload:
+
+```sh
+sudo nft -f /etc/fips/fips.nft
+```
+
+Then tail the kernel log:
+
+```sh
+sudo journalctl -k -f -g "fips drop:"
+```
+
+The rate-limit prevents flooding the journal under sustained probing.
+Adjust the rate, log level, or prefix as needed for the situation.
+Re-comment the rule when you are done; production hosts do not need
+the log line on by default.
+
+## See also
+
+- [../design/fips-security.md](../design/fips-security.md) — threat
+  model, baseline design, and coexistence with other firewalls
+- [../reference/security.md](../reference/security.md) — consolidated
+  security reference